PhishingPublished 10 Jun 2026

The 5 Best Practices for Secure Identity Verification

Source Bleeping Computer

Description

Attackers are increasingly bypassing weak authentication through phishing, MFA fatigue, and service desk social engineering. Specops Software breaks down five best practices for stronger identity verification and access security. [...]

Impact

Credential theft surged by 160% in 2025, contributing to 20% of data breaches. Attackers bypass weak authentication through phishing, MFA fatigue, and social engineering, leading to account compromises and enabling further attacks such as ransomware and lateral movement. Service desk social engineering attacks have caused significant operational and financial impacts, exemplified by a five-day sales suspension at Marks and Spencers with daily losses of £3.8 million. Weak onboarding, static credentials, and inconsistent authentication policies increase exposure to these threats.

Defensive guidance

This guidance recommends adopting strong, phishing-resistant MFA methods such as FIDO2 security keys and authenticator apps generating local OTPs, moving away from vulnerable SMS/email OTPs. Organizations should secure service desks by embedding identity verification into workflows and using biometric liveness detection for high-risk actions. Incorporating device trust signals into authentication decisions helps differentiate legitimate from suspicious access attempts. Considering passkeys can reduce password reliance, but strong password policies remain necessary where passwords are fallback methods. Protect biometric data by storing encrypted templates and performing local authentication where possible. No specific patch or fix applies as this is best practice guidance rather than a software vulnerability.

Summary

The article discusses the rising threat of credential theft and sophisticated attacks that exploit weak identity verification processes. It emphasizes the importance of multi-factor authentication combining different factor categories, securing service desks against social engineering (including AI-enabled deepfakes), integrating device trust signals into access decisions, adopting passkeys based on FIDO2/WebAuthn standards to reduce reliance on passwords, and protecting biometric data by avoiding raw data storage and using encryption and local authentication. These practices collectively aim to mitigate risks of account takeover and unauthorized access in modern authentication workflows.

References

bleepingcomputer.com/news/security/the-5-best-practices-for-secure-identity-verification/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Jun 2026, 14:19 UTC

References

Community reviews